I dont think we can ship a custom .htaccess for that, at least we cant override the parent one. You might want to check which urls are accessible without login.